Draft for review. This notice describes the information visible in the current application code. The responsible legal entity, contact details, jurisdiction, age policy, regional rights process, and retention schedule still require owner and legal confirmation.
Information the service handles
Depending on how you use the service, the application may process account name and email, sign-in and Google identity identifiers, profile image, account status, device or advertising identifiers, country and location signals, IP address, sign-in history, offer activity, reward and points ledger entries, redemption requests, payout recipient details, support messages, notification preferences, and security or fraud review records. The exact fields depend on the feature and provider.
Why information is used
The application uses information to authenticate accounts, show offers and missions, record progress, calculate and review rewards, handle redemption requests, protect the service, respond to support, and operate notifications and reporting features. Provider verification may be needed before an activity is credited.
Service providers and sharing
The codebase includes integrations for Google identity, Adjoe and ayeT offer callbacks/reporting, Singular attribution and event reporting, OneSignal notifications, and Reloadly gift-card fulfillment. An integration may be disabled or configured differently in a deployment. Before publication, the owner must confirm which providers are active, the data each receives, their legal roles, locations, subprocessors, and current privacy terms. Do not assume every integration is enabled.
Cookies and browser storage
Browser sessions and security protections use cookies. The administrator panel uses a host-only secure session cookie in production. Flutter API authentication uses bearer tokens; the public pages do not require an administrator session. This draft does not describe an analytics cookie inventory or consent configuration; those must be reviewed before approval.
Retention, deletion, and financial records
The in-app account deletion action anonymizes direct account details, revokes tokens, and removes selected profile, device, communication, and payout-recipient information. The application preserves some transaction and settlement records for reconciliation and removes or redacts selected provider data. This is not an immediate erasure of every record. The owner must approve the retention periods, legal exceptions, backup expiry, and request-handling schedule.
If you can sign in, use Profile → Delete account. If you cannot access the account, submit a privacy request using the contact form. A support request is not itself a completed deletion: staff must verify account ownership and process it under the approved procedure.
Children, regional rights, and transfers
The minimum age, child-user rules, controller identity, applicable legal bases, international transfer safeguards, jurisdiction, and regional rights process have not been confirmed. These items are required for owner and legal review before publication. This draft makes no claim of compliance with a particular privacy law.
Questions and updates
Use the Prizika support form for account and privacy questions. The approved policy version and effective date must be recorded before launch.